analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

safebrowsing.exe

Full analysis: https://app.any.run/tasks/91e4579f-eeef-415a-a815-00186abdae59
Verdict: Malicious activity
Analysis date: February 18, 2019, 20:07:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9D93897D0273262E09E0B92612218E26

SHA1:

9FA57853253376C17DCDFDAC1308D190B4FB8BCA

SHA256:

7ADE35256B6046540448AE46B4A7DEB82A9C9E3DD400BB94683632B480997FBC

SSDEEP:

12288:FTBieM+PAwQvvciGEf00/zqeQMsSIqIBa:FTYlHvvci5f0mrQF1qIBa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • DllHost.exe (PID: 2432)
      • safebrowsing.exe (PID: 3140)
      • AUDIODG.EXE (PID: 3360)
      • consent.exe (PID: 3716)
      • cmd.exe (PID: 2664)
      • DllHost.exe (PID: 2168)
      • DllHost.exe (PID: 3320)
      • conhost.exe (PID: 2740)
      • safebrowsing.exe (PID: 3120)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • safebrowsing.exe (PID: 3140)
    • Executable content was dropped or overwritten

      • safebrowsing.exe (PID: 3140)
      • safebrowsing.exe (PID: 3120)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (33)
.exe | Win32 Executable MS Visual C++ (generic) (23.9)
.exe | Win64 Executable (generic) (21.2)
.scr | Windows screen saver (10)
.dll | Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:02:18 20:56:29+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 338432
InitializedDataSize: 287232
UninitializedDataSize: -
EntryPoint: 0x4d9b2
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 5.6.3.3234
ProductVersionNumber: 5.6.3.3234
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Visit http://www.winamp.com/ for ipdates.
CompanyName: Nullsoft, Inc.
FileDescription: Winamp ikstaller
FileVersion: 5.6.3.3234
LegalCopyright: Copyright © 1997-2012, Nullsoft, Inc.
LegalTrademarks: Nullsoft and Winamp are trademarks of Nullsoft, Inc.
ProductName: Winamp ikstaller
ProductVersion: 5.63 Build 3234
SpecialBuild: Pro

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Feb-2019 19:56:29
Detected languages:
  • English - United States
Comments: Visit http://www.winamp.com/ for ipdates.
CompanyName: Nullsoft, Inc.
FileDescription: Winamp ikstaller
FileVersion: 5.6.3.3234
LegalCopyright: Copyright © 1997-2012, Nullsoft, Inc.
LegalTrademarks: Nullsoft and Winamp are trademarks of Nullsoft, Inc.
ProductName: Winamp ikstaller
ProductVersion: 5.63 Build 3234
SpecialBuild: Pro

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 18-Feb-2019 19:56:29
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000529EE
0x00052A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.71935
.rdata
0x00054000
0x00003D68
0x00003E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.95207
.data
0x00058000
0x0001305C
0x00012600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.281597
.rsrc
0x0006C000
0x0002F1F8
0x0002F200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.17073

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.49484
960
UNKNOWN
UNKNOWN
RT_VERSION
2
3.13959
2664
UNKNOWN
English - United States
RT_ICON
3
3.17658
1640
UNKNOWN
English - United States
RT_ICON
4
3.49088
744
UNKNOWN
English - United States
RT_ICON
5
3.37254
488
UNKNOWN
English - United States
RT_ICON
6
3.15409
296
UNKNOWN
English - United States
RT_ICON
7
4.48889
19496
UNKNOWN
English - United States
RT_ICON
8
4.75913
5672
UNKNOWN
English - United States
RT_ICON
9
4.67069
3752
UNKNOWN
English - United States
RT_ICON
10
4.49636
2216
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
9
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start safebrowsing.exe Thumbnail Cache Out of Proc Server no specs consent.exe no specs audiodg.exe no specs Profile Notification Host no specs Profile Notification Host no specs cmd.exe conhost.exe no specs safebrowsing.exe

Process information

PID
CMD
Path
Indicators
Parent process
3140"C:\Users\admin\Desktop\safebrowsing.exe" C:\Users\admin\Desktop\safebrowsing.exe
explorer.exe
User:
admin
Company:
Nullsoft, Inc.
Integrity Level:
MEDIUM
Description:
Winamp ikstaller
Version:
5.6.3.3234
2432C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3716consent.exe 844 340 01E924D0C:\Windows\system32\consent.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
3221225547
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3360C:\Windows\system32\AUDIODG.EXE 0x6b0C:\Windows\system32\AUDIODG.EXEsvchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Audio Device Graph Isolation
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3320C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\system32\DllHost.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2168C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}C:\Windows\system32\DllHost.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2664"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\Desktop\safebrowsing.exe" C:\Windows\System32\cmd.exe
safebrowsing.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2740\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.execsrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3120C:\Users\admin\Desktop\safebrowsing.exe C:\Users\admin\Desktop\safebrowsing.exe
cmd.exe
User:
admin
Company:
Nullsoft, Inc.
Integrity Level:
HIGH
Description:
Winamp ikstaller
Version:
5.6.3.3234
Total events
254
Read events
238
Write events
16
Delete events
0

Modification events

(PID) Process:(3140) safebrowsing.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3140) safebrowsing.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3716) consent.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000_CLASSES\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3716) consent.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\CTF\MSUTB
Operation:writeName:Left
Value:
1226
(PID) Process:(3716) consent.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\CTF\MSUTB
Operation:writeName:Top
Value:
0
Executable files
9
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\2277.tmp
MD5:
SHA256:
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\1CA7.tmp
MD5:
SHA256:
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\4F43435A.tmpexecutable
MD5:94BF8C26C5B85C2C490CF4440AB8170B
SHA256:873A2BA4C3BB88B9354EAB47B8E5F8118212A63ABF7CB149696A385EDB57DD63
3120safebrowsing.exeC:\Users\admin\AppData\Roaming\MozillaFirefoxb\MozillaFirefoxb.comexecutable
MD5:9D93897D0273262E09E0B92612218E26
SHA256:7ADE35256B6046540448AE46B4A7DEB82A9C9E3DD400BB94683632B480997FBC
3140safebrowsing.exeC:\Users\admin\AppData\Local\Temp\38743579.tmpexecutable
MD5:ED60C95C805DBAEE92C90C3AB930085A
SHA256:D35574D2CC42B4EDBF217A86639864422FBE02443250A36EB2CD11B22F165C39
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\30424556.tmpexecutable
MD5:ED60C95C805DBAEE92C90C3AB930085A
SHA256:D35574D2CC42B4EDBF217A86639864422FBE02443250A36EB2CD11B22F165C39
3140safebrowsing.exeC:\Users\admin\AppData\Local\Temp\386F3630.tmpexecutable
MD5:95E2376B3323F062EB562B8586D0F14A
SHA256:BD3FA8750123D00AA0967FBA44372C46EA002681DA9C9B77A4F9261553E26017
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\54703463.tmpexecutable
MD5:95E2376B3323F062EB562B8586D0F14A
SHA256:BD3FA8750123D00AA0967FBA44372C46EA002681DA9C9B77A4F9261553E26017
3140safebrowsing.exeC:\Users\admin\AppData\Local\Temp\72766C6C.tmpexecutable
MD5:94BF8C26C5B85C2C490CF4440AB8170B
SHA256:873A2BA4C3BB88B9354EAB47B8E5F8118212A63ABF7CB149696A385EDB57DD63
3120safebrowsing.exeC:\Users\admin\AppData\Local\Temp\4B534D73.tmpexecutable
MD5:5553784D774CA845380650E010BBDA2C
SHA256:FF4C354D08C8A6A6554DE195C72E5C940BE0DEF803CE0BE8312161943A0F5821
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info